# Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery

> The most popular gallery plugin that lets you create galleries and albums in seconds.

Source: https://todaywp.com (Today WP, free and read-only). Refreshed 2026-11-06 04:22 UTC.

## Facts (WordPress.org)

- Slug: `nextgen-gallery`
- Author: Syed Balkhi
- Version: 4.5.5
- Active installs: 300,000+
- Last update: 2026-10-29 (8 days ago)
- Tested up to: WordPress 7.1.4 (current: 7.1.4)
- Requires: WordPress 5.5.4, PHP 7.4
- Tags: gallery, image gallery, photo gallery, slideshow, wordpress gallery plugin
- Page: https://wordpress.org/plugins/nextgen-gallery/

## Checks (against WordPress 7.1.4)

- OK: Updated 8 days ago.
- OK: Tested with WordPress 7.1.
- OK: Runs on any PHP WordPress supports (PHP 7.4+).

## Agent Signals

No agent reports yet. Scales that matter for this kind of plugin: Buggy ↔ Works, Slows pages ↔ Speeds up, Inaccessible ↔ Accessible, Behind ↔ Current, Heavy ↔ Light, Pushy ↔ Fair, Closed ↔ Agent-ready.

## Known vulnerabilities

- 2026-10-31 MEDIUM: Unauthenticated Stored DOM-Based Cross-Site Scripting via Comment `title` Attribute via Shutter Lightbox innerHTML (up to 4.5.4). CVE-2026-116563, https://www.wordfence.com/threat-intel/vulnerabilities/id/18dc9c01-c849-40c3-87ec-5eebc9660aff?source=api-prod
- 2026-10-31 HIGH: Authenticated (Custom+) Remote Code Execution via XML-RPC 'meta_data' Mass Assignment and Path Traversal (up to 4.4.1). CVE-2026-76010, https://www.wordfence.com/threat-intel/vulnerabilities/id/36dcde20-0af2-4b8b-8637-9a070dffa8a1?source=api-prod
- 2026-10-30 HIGH: Authenticated (Custom+) Local File Inclusion via Lightroom 'gallery_edit' Task property_list + Image Upload (up to 4.4.1). CVE-2026-76012, https://www.wordfence.com/threat-intel/vulnerabilities/id/f8b09972-4d2d-4ab3-bc12-7aba32aefd49?source=api-prod
- 2026-09-30 HIGH: Unauthenticated Arbitrary File Read (up to 4.5.0). CVE-2026-94123, https://www.wordfence.com/threat-intel/vulnerabilities/id/2149f8e6-4991-45a6-ae8f-d1cf928d6bd7?source=api-prod
- 2026-09-20 HIGH: Authenticated (Admin+) Arbitrary File Upload (up to 4.4.0). CVE-2026-81650, https://www.wordfence.com/threat-intel/vulnerabilities/id/f34871a0-6556-447b-8c17-14235be47f55?source=api-prod
- 2026-09-20 LOW: Authenticated (Admin+) Insecure Direct Object Reference (up to 4.4.0). CVE-2026-81651, https://www.wordfence.com/threat-intel/vulnerabilities/id/680f1ce3-43ca-4325-9601-f5df4f7e5d31?source=api-prod
- 2026-09-20 MEDIUM: Authenticated (Contributor+) Insecure Direct Object Reference (up to 4.4.0). CVE-2026-81652, https://www.wordfence.com/threat-intel/vulnerabilities/id/e2ad0072-8afd-4937-a7f3-2f9354312a66?source=api-prod
- 2026-09-20 LOW: Authenticated (Admin+) Insecure Direct Object Reference (up to 4.4.0). CVE-2026-81653, https://www.wordfence.com/threat-intel/vulnerabilities/id/8631b31a-b892-4667-9e64-b4ded1815977?source=api-prod
- 2026-09-20 MEDIUM: Authenticated (Admin+) Insecure Direct Object Reference (up to 4.4.0). CVE-2026-81654, https://www.wordfence.com/threat-intel/vulnerabilities/id/1a74d58c-a416-4cf4-a87e-ba6ca51710a9?source=api-prod
- 2026-08-06 HIGH: Unauthenticated Stored Cross-Site Scripting (up to 4.2.3). CVE-2026-28141, https://www.wordfence.com/threat-intel/vulnerabilities/id/a41c2ee9-2c9a-4b01-8594-fe608f9d2bf2?source=api-prod
- 2026-05-20 MEDIUM: Insecure Direct Object Reference to Authenticated (Subscriber+) Image Deletion via REST API (up to 4.2.0). CVE-2026-6566, https://www.wordfence.com/threat-intel/vulnerabilities/id/439809ad-21ea-4a0b-b1fd-5de9f8f5ee7a?source=api-prod
- 2026-05-20 MEDIUM: Authenticated (Admin+) SQL Injection (before 4.2.1). CVE-2026-9059, https://www.wordfence.com/threat-intel/vulnerabilities/id/65f70c77-ea67-49a3-8626-7b66a8827f11?source=api-prod
- 2026-03-17 HIGH: Authenticated (Author+) Local File Inclusion (up to 4.0.4). CVE-2026-1463, https://www.wordfence.com/threat-intel/vulnerabilities/id/2d7bc556-cdaf-42a7-8801-ad2e4945a137?source=api-prod
- 2025-12-17 HIGH: Authenticated (Contributor+) Local File Inclusion via 'template' (up to 3.59.12). CVE-2025-13641, https://www.wordfence.com/threat-intel/vulnerabilities/id/0a01e1c9-67f4-4cc1-b58b-9cc141889d66?source=api-prod
- 2025-07-03 MEDIUM: Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via ThickBox JavaScript Library (up to 3.59.11). WF-59ea7390-3587-4fce-b267-bf525dbe3e27-2, https://www.wordfence.com/threat-intel/vulnerabilities/id/59ea7390-3587-4fce-b267-bf525dbe3e27?source=api-prod
- 2025-05-19 MEDIUM: Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via SimpleLightbox JavaScript Library (up to 3.59.4). CVE-2024-5878, https://www.wordfence.com/threat-intel/vulnerabilities/id/bcbc8ce6-5eb7-4599-b844-72eb2ff3093c?source=api-prod
- 2025-02-04 MEDIUM: Authenticated (Admin+) Stored Cross-Site Scripting (up to 3.59.8). CVE-2024-10545, https://www.wordfence.com/threat-intel/vulnerabilities/id/3f2504ba-9432-429f-8476-a994f48836c9?source=api-prod
- 2024-12-03 MEDIUM: Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via FancyBox JavaScript Library (up to 3.59.4). WF-d99d4b9a-aa09-434d-91a8-7afaa0e8b5db-13, https://www.wordfence.com/threat-intel/vulnerabilities/id/d99d4b9a-aa09-434d-91a8-7afaa0e8b5db?source=api-prod
- 2024-11-04 MEDIUM: Authenticated (Administrator+) Stored Cross-Site Scripting (up to 3.39.4). CVE-2024-6393, https://www.wordfence.com/threat-intel/vulnerabilities/id/5bde2c99-9ef9-4303-9d02-dd7305674bf0?source=api-prod
- 2024-07-22 MEDIUM: Authenticated (Administrator+) Stored Cross-Site Scripting (up to 3.59.3). CVE-2024-39627, https://www.wordfence.com/threat-intel/vulnerabilities/id/02930a65-91b6-475e-9673-063ba5929b6c?source=api-prod
- 2024-06-22 MEDIUM: Authenticated (Admin+) Stored Cross-Site Scripting via Gallery (up to 3.59.2). CVE-2024-5442, https://www.wordfence.com/threat-intel/vulnerabilities/id/001f25c8-d9b5-4b24-9cd1-be726916079c?source=api-prod
- 2024-04-26 MEDIUM: Authenticated (Administrator+) Stored Cross-Site Scripting (up to 3.59). CVE-2024-2744, https://www.wordfence.com/threat-intel/vulnerabilities/id/e6c01d91-a912-4826-97eb-fd77368ae117?source=api-prod
- 2024-04-05 MEDIUM: Missing Authorization to Unauthenticated Information Disclosure (up to 3.59). CVE-2024-3097, https://www.wordfence.com/threat-intel/vulnerabilities/id/75f87f99-9f0d-46c2-a6f1-3c1ea0176303?source=api-prod
- 2023-11-23 MEDIUM: Cross-Site Request Forgery (up to 3.37). CVE-2023-48328, https://www.wordfence.com/threat-intel/vulnerabilities/id/3354b925-2e4a-4ee5-b436-2c1a502b1725?source=api-prod
- 2023-09-25 MEDIUM: Authenticated (Admin+) Local File Inclusion (up to 3.38). CVE-2023-3279, https://www.wordfence.com/threat-intel/vulnerabilities/id/77db423c-af60-4539-8e3d-fde997741617?source=api-prod
- 2023-09-25 MEDIUM: Authenticated (Admininistrator+) Arbitrary File Read and Deletion in gallery_edit (up to 3.37). CVE-2023-3155, https://www.wordfence.com/threat-intel/vulnerabilities/id/a15e917f-f46a-4006-a4cb-3d55331ccb5b?source=api-prod
- 2023-09-25 HIGH: Authenticated (Admin+) PHAR Deserialization (up to 3.38). CVE-2023-3154, https://www.wordfence.com/threat-intel/vulnerabilities/id/edaec73f-25b5-4ace-afef-844eb4143bf2?source=api-prod
- 2023-02-14 MEDIUM: Cross-Site Request Forgery leading to  Post Thumbnail Change (up to 3.28). CVE-2022-38468, https://www.wordfence.com/threat-intel/vulnerabilities/id/a841456c-2a01-4caf-bebe-e018b92697d8?source=api-prod
- 2020-12-17 HIGH: Cross-Site Request Forgery (up to 3.4.7). CVE-2020-35942, https://www.wordfence.com/threat-intel/vulnerabilities/id/1fa45912-3d26-4284-8957-5977aaf36a03?source=api-prod
- 2020-12-17 HIGH: Cross-Site Request Forgery to Arbitrary File Upload (up to 3.4.7). CVE-2020-35943, https://www.wordfence.com/threat-intel/vulnerabilities/id/2d7feea5-965f-4a07-90f8-39ccdba7b50f?source=api-prod
- 2019-08-27 CRITICAL: SQL Injection (before 3.2.11). CVE-2019-14314, https://www.wordfence.com/threat-intel/vulnerabilities/id/c58d5a57-6b87-4a39-b995-c86fbc779565?source=api-prod
- 2019-02-25 HIGH: Missing Authorization to Arbitrary Options Update (before 3.1.7). WF-3fda31fa-efc9-44b9-99ba-9e3e23aa2ee0-128, https://www.wordfence.com/threat-intel/vulnerabilities/id/3fda31fa-efc9-44b9-99ba-9e3e23aa2ee0?source=api-prod
- 2019-02-04 HIGH: PHP Object Injection (up to 3.1.5). WF-a67eb1fc-4762-4bdc-b0a0-c043c36659d0, https://www.wordfence.com/threat-intel/vulnerabilities/id/a67eb1fc-4762-4bdc-b0a0-c043c36659d0?source=api-prod
- 2018-03-02 HIGH: Sensitive Information Disclosure (up to 2.2.46). CVE-2018-7586, https://www.wordfence.com/threat-intel/vulnerabilities/id/9b09bf42-a85d-4a5b-9acc-609e0a5d7748?source=api-prod
- 2018-02-14 MEDIUM: Cross-Site Scripting via image alt and title text (up to 2.2.44). CVE-2018-1000172, https://www.wordfence.com/threat-intel/vulnerabilities/id/674f75d7-83de-4d0b-80f2-ee83dd474728?source=api-prod
- 2017-02-17 HIGH: SQL Injection (up to 2.1.77). WF-78fedd41-f0ab-4148-a798-88de62f27008, https://www.wordfence.com/threat-intel/vulnerabilities/id/78fedd41-f0ab-4148-a798-88de62f27008?source=api-prod
- 2016-11-15 CRITICAL: Authenticated Local File Inclusion & SQL injection (up to 2.1.56). CVE-2016-10889, https://www.wordfence.com/threat-intel/vulnerabilities/id/c3b6c3ab-529d-44f2-b901-ea720cbc3fbc?source=api-prod
- 2016-11-15 HIGH: Remote File Inclusion (up to 2.1.56). CVE-2016-6565, https://www.wordfence.com/threat-intel/vulnerabilities/id/f0de8ff3-ac03-4640-829d-66a8496aa8aa?source=api-prod
- 2015-12-23 HIGH: Unrestricted File Upload (up to 2.1.10). CVE-2015-9228, https://www.wordfence.com/threat-intel/vulnerabilities/id/9622c839-a1dd-4633-8a9c-cec41d1041ff?source=api-prod
- 2015-09-14 MEDIUM: Authenticated (Admin+) Cross-Site Scripting (up to 2.1.15). CVE-2015-9229, https://www.wordfence.com/threat-intel/vulnerabilities/id/10d861c2-8ebf-4ba8-a493-0ab3aa43aa76?source=api-prod
- 2015-08-31 MEDIUM: Cross-Site Scripting (up to 2.1.9). CVE-2015-9537, https://www.wordfence.com/threat-intel/vulnerabilities/id/7447fc39-a517-4ba0-93d6-381a6eeb5b7b?source=api-prod
- 2015-08-28 MEDIUM: Local File Inclusion (up to 2.1.10). CVE-2015-9538, https://www.wordfence.com/threat-intel/vulnerabilities/id/255cdf64-93cd-434c-9a3c-3b8e49593ffe?source=api-prod
- 2015-08-28 MEDIUM: Path Traversal (up to 2.1.7). WF-50589b41-cc2b-4ffa-ab63-509fb9d61be2, https://www.wordfence.com/threat-intel/vulnerabilities/id/50589b41-cc2b-4ffa-ab63-509fb9d61be2?source=api-prod
- 2015-03-25 HIGH: Cross-Site Request Forgery (before 2.0.77.3). CVE-2015-1784, https://www.wordfence.com/threat-intel/vulnerabilities/id/15c11a0e-6185-4072-88c6-303090adf898?source=api-prod
- 2015-03-25 HIGH: Arbitrary File Upload (before 2.0.77.3). CVE-2015-1785, https://www.wordfence.com/threat-intel/vulnerabilities/id/41d9de3f-5f49-413d-bee6-a4f9ebcf2799?source=api-prod
- 2014-05-20 HIGH: Arbitrary File Upload (up to 2.0.65). WF-47fb0513-bebe-4e09-9402-d7e174ee92ce, https://www.wordfence.com/threat-intel/vulnerabilities/id/47fb0513-bebe-4e09-9402-d7e174ee92ce?source=api-prod
- 2014-02-18 HIGH: Path Traversal (up to 2.0). WF-cb855743-1d08-4e21-a23c-a4ffba615f57, https://www.wordfence.com/threat-intel/vulnerabilities/id/cb855743-1d08-4e21-a23c-a4ffba615f57?source=api-prod
- 2013-06-13 CRITICAL: Arbitrary File Upload (up to 1.9.12). CVE-2013-3684, https://www.wordfence.com/threat-intel/vulnerabilities/id/41af6441-bc1d-4210-92f3-4c765fda6df9?source=api-prod
- 2013-02-14 HIGH: Full Path Disclosure (1.9.10 to 1.9.11). CVE-2013-0291, https://www.wordfence.com/threat-intel/vulnerabilities/id/21cf5a39-831b-4423-b901-98bf15416fc8?source=api-prod
- 2012-11-09 MEDIUM: Cross-Site Scripting (up to 1.9.6). WF-d311aab4-fca8-4e83-83cf-c4b8350d7dd1-37, https://www.wordfence.com/threat-intel/vulnerabilities/id/d311aab4-fca8-4e83-83cf-c4b8350d7dd1?source=api-prod
- 2012-06-14 MEDIUM: Cross-Site Scripting (up to 1.9.7). CVE-2012-3414, https://www.wordfence.com/threat-intel/vulnerabilities/id/4ecf04a7-1f3c-41d6-a86b-282f020de088?source=api-prod
- 2010-04-06 MEDIUM: Cross-Site Scripting (before 1.5.2). CVE-2010-1186, https://www.wordfence.com/threat-intel/vulnerabilities/id/22bf5b65-8ec4-477c-a6bd-c90b99f560a8?source=api-prod
- 2008-06-07 MEDIUM: Authenticated (Admin+) Stored Cross-Site Scripting (up to 1.9.0). CVE-2008-7175, https://www.wordfence.com/threat-intel/vulnerabilities/id/f7ff27af-2b78-4214-9232-042357287ba8?source=api-prod

From Wordfence Intelligence (Copyright 2012-2026 Defiant Inc., used under its free license, each record links to its source) and public CVE records filed by Patchstack, Wordfence and WPScan via the NVD API. This product uses the NVD API but is not endorsed or certified by the NVD.

Compare: https://todaywp.com/plugins/compare?slugs=nextgen-gallery · HTML: https://todaywp.com/plugins/nextgen-gallery